I’ve been testing iodéOS on my Pixel 4a (sunfish) and I’m really impressed. I’m normally very much a root user, but iodéOS is working so well, and is still so actively maintained for sunfish, that I’m seriously considering using it unrooted.
One feature I particularly miss comes from AXP.OS. Unfortunately, its developer passed away and the project now seems effectively frozen.
AXP.OS included a patched Google Play setup that worked very well together with Insular. I could keep Google Play entirely inside the isolated profile, update apps normally there, and avoid giving Google access to my main profile.
This also worked surprisingly well for banking apps. Until recently even Yuh worked for me this way; now it seems to require stronger hardware-backed integrity. Swissquote, Scalable Capital and several less restrictive apps still worked fine with this setup.
There is also a more important long-term reason why I think this could be interesting for iodéOS: Google’s increasing control over Android app installation and developer verification: https://keepandroidopen.org/
Since iodé is already supporting Keep Android Open, have you considered preserving or adapting the patched Google Play approach from AXP.OS?
A few smaller things from my “ideal ROM” wishlist:
The region-independent call recorder is great, thanks for that.
Any chance of a developer option to ignore FLAG_SECURE?
Have you considered integrating Neo Backup, or a similar privileged backup solution?
With those features I would have almost no reason left to root the phone. Almost — FMD and Amarok would still tempt me.
But my main question is really the patched Google Play approach: would something like this fit technically and philosophically with iodéOS?
Thanks again for keeping sunfish alive and actively maintained.
Sorry it took me a while to approve your post (it gets flagged for moderation sometimes for a new user if it was typed “suspiciously fast”).
Anyway, thanks for the insights and comments. There are a few good discussions to have here.
Patched Google Play: first could you point us to the source for the AXP.OS patches you are referring to? Note that microG works fine in a “work profile” setup such as Shelter and I assume Insular as well. But you are referring to full Google Play Services but patched … how is this possible? I didn’t think it was open code so is it maybe unofficially decompiled / reverse engineered or something?
On NeoBackup or other, I think they would require userdebug builds, correct? That is a decision our lead developer does not want to follow and they strongly prefer to only build as user builds. Note that unofficial builds can be made that could be userdebug.
Ignoring FLAG_SECURE: can you give a bit more clarification?
Thanks for approving the post, and no worries at all about the delay! I’m just glad to be able to join the discussion.
And yes, I should correct/clarify one detail from my first post.
I wasn’t referring to patched Google Play Services themselves. AXP.OS used microG together with a patched native Google Play Store (Phonesky).
The relevant source is the AXP.OS packages_apps_phonesky repository, especially the patch-playstore script. As far as I understand it, it takes an official Google Play APK, decompiles it with apktool, applies the patches and rebuilds it. So yes, in that sense it is patching/decompiling the proprietary Play Store APK rather than building Google Play from source.
One other correction regarding my Insular setup: the patched Play Store was still present in the normal/owner profile as a system app. Insular wasn’t natively integrated into AXP.OS; I used it to create the isolated work profile and cloned the patched Play Store into it.
I then logged into Google Play inside that Insular profile and installed the problematic apps from there. I did not need to log into Google Play in my normal profile.
For some banking apps there was an additional workaround. For example, Yuh used to require me to install it in the owner profile first, apply my Magisk/root-hiding setup there, and then clone it into Insular. That worked for quite a while.
Yuh no longer accepts that setup, apparently because its integrity requirements have become stricter. Swissquote, on the other hand, still works for me using essentially that approach.
So the interesting part for me isn’t really “full Google services in a work profile”, but rather the combination of microG + patched Phonesky + a separate Insular work profile. It gave me a surprisingly useful middle ground for apps that refused microG/FakeStore alone.
Regarding Neo Backup: fair enough. My thought there was simply having some kind of privileged backup solution integrated into the ROM, so that app + app-data backups would be possible without rooting the phone. If Neo Backup specifically would require changes that don’t fit your user build model, then I understand why that isn’t attractive.
And regarding FLAG_SECURE: yes, I mainly mean screenshots. Some apps , particularly banking and other security-sensitive apps , set FLAG_SECURE and Android then refuses to take a screenshot of that window.
What I had in mind was an optional Developer Options toggle to globally ignore FLAG_SECURE, so that, when explicitly enabled by the user, screenshots would work everywhere regardless of whether an app requests screenshot protection.
Screen recording/casting would be a nice side effect too, but screenshots are really my main use case.
